background image

XEROX WorkCentre 

3550 

Information Assurance Disclosure Paper 

 

29 

Ver. 1.3, March 2011 

        

Page 

 29 of 32 

6.2.

 

Appendix B – Supported MIB Objects  

 
NOTES : 

(1)

 

The number of objects shown per MIB group represents the number of objects defined by the IETF standard 
for that MIB group.  It does not represent the instantiation of the MIB group which may contain many more 
objects. 

(2)

 

Some  MIB  objects  defined  within  Input  and  Output  groups  of  the  Printer  MIB  (

RFC  1759

)  have  a  MAX-

ACCESS  of  RW.    However,  the  Printer  MIBv2  defines  a  MIB-ACCESS  of  RO  for  these  MIB  objects  within  the 
Input  and  Output  groups  and  all  machines  assessed  support  RO  access.  Therefore,  RO  access  to  these  MIB 
objects is considered IETF compliant. 

(3)

 

It is assumed that mandatory IETF string-related MIB objects shall contain meaningful data; not blank strings 

(4)

 

The  "

(C)

"  notation  indicates  that  the  previously  stated  item  is  a  true  caveat  condition.    The  "

(I)

"  notation 

indicates that the previous stated item should be regarded as information only.  

(5)

 

MIB  objects  that  CANNOT  be  populated  with  meaningful  data  (e.g.  a  machine  may  not  have  paper  level 
sensors, hence, can only support "0" or "-3 for more than 1 sheet" for prtInputCurrentLevel) will be considered 
a caveat, denoted as "(C)". 

(6)

 

The  Printer  MIB  requires  a  few  groups  from  RFC  1213  and  RFC  1514  to  be  supported.  Therefore,  this 
assessment  will  indicate  that  these  groups  are  "supported"  as  long  as  the  basic  MIB  structures  have  been 
implemented.  

 
 

SNMP version / Network Transport support 

WorkCentre 

 

SNMPv1 (RFC 1157) 

supported 

SNMPv2P (RFCs 140x) 

supported 

SNMPv2C (RFCs 190x) 

supported 

SNMPv3 (RFCs 1902, 2572, 2574) 

supported 

SNMP over UDP (IP) 

supported 

SNMP over IPX (Netware) 

 not supported

 

SNMP over NETBEUI (Microsoft Networking) 

not supported 

 

RFC 1759 - Printer MIB Group

 

WorkCentre

 

RFC 1213 - System group 

supported 

RFC 1213 - Interface group 

supported 

RFC 1514 - Storage group 

supported 

RFC 1514 - Device group 

supported 

General group [

7 objects

supported 

Covers group [

3 objects

supported 

Localization group [

4 objects

supported (only US English language supported) 

Responsible Party group [

2 objects

] –

 OPTIONAL

 

Not supported 

 

System Resources group [

4 objects

supported 

Input group [

12 objects

supported 

 

Extended Input group [

7 objects

]

 - OPTIONAL 

supported 

Input Media group [

4 objects

] - 

OPTIONAL 

supported 

Output group [

6 objects

supported

 

Extended Output group [

7 objects

] -

 OPTIONAL 

supported 

Output Dimensions group [

5 objects

OPTIONAL 

supported 

Output Features group [

6 objects

] - 

OPTIONAL 

supported 

Marker group [

15 objects

supported 

Marker Supplies group [

9 objects

] - 

OPTIONAL 

supported 

Marker Colorant group [

5 objects

] - 

OPTIONAL 

supported 

Media Path group [

11 objects

supported 

Channels group [

8 objects

supported 

Interpreter group [

12 objects

supported 

Console group [

4 objects

supported 

Console Display Buffer group [

2 objects

supported 

Console Display Light group [

5 objects

Not supported 

 

Alert Table group [8

 objects

supported 

Alert Time group [

1 object

] - 

OPTIONAL 

supported 

 

Summary of Contents for WorkCentre 3550

Page 1: ...Xerox WorkCentre 3550 Information Assurance Disclosure Paper Version 1 2 Prepared by Mark Bixler Xerox Corporation 800 Phillips Road Webster New York 14580...

Page 2: ...March 2011 Page 2 of 32 2011 Xerox Corporation All rights reserved Xerox and the sphere of connectivity design are trademarks of Xerox Corporation in the United States and or other counties Other com...

Page 3: ...2 2 4 USB Ports 10 2 3 Fax Module 11 2 3 1 Purpose 11 2 3 2 Hardware 11 2 4 Scanner 11 2 4 1 Purpose 11 2 4 2 Hardware 11 2 5 Local User Interface LUI 12 2 5 1 Purpose 12 2 5 2 Hardware 12 2 6 Markin...

Page 4: ...ultifunction models only 24 3 3 2 Network Scanning Multifunction models only 24 3 4 Diagnostics 24 4 SECURITY ASPECTS OF SELECTED FEATURES 25 4 1 SMart eSolutions 25 4 2 1 Meter Assistant 25 4 2 2 Sup...

Page 5: ...n functions and features of the WorkCentre products relative to Information Assurance IA This document does NOT provide tutorial level information about security connectivity PDLs or WorkCentre produc...

Page 6: ...input document handler and scanner marking engine including paper path controller and user interface Figure 2 1 WorkCentre Multifunction System Document Feeder Scanner IIT Marking Engine IOT Paper Tra...

Page 7: ...Disclosure Paper 7 Ver 1 3 March 2011 Page 7 of 32 2 1 Security relevant Subsystems 2 1 1 Physical Partitioning The security relevant subsystems of the product are partitioned as shown in Figure 2 2...

Page 8: ...ce Network Authentication Controller Graphical User Interface Cryptographic Operations Controller User Data Protection SSL Controller User Data Protection IP Filtering Controller User Data Protection...

Page 9: ...ead from DRAM and sent to the Image Output Terminal IOT for marking on hardcopy output For long documents the production of hardcopy may begin before the entire original is scanned achieving a level o...

Page 10: ...are limited to controller parameters that are needed for normal operation Both ports can be disabled by an Admin via the WebUI USB USB port and location Purpose USB 2 0 Host port Printing from USB sc...

Page 11: ...rk Volatile Memory Description Type SRAM DRAM etc Size User Modifiable Y N Function or Use Process to Clear None n a n a n a n a Additional Information Non Volatile Memory Description Type Flash EEPRO...

Page 12: ...n Type Flash EEPROM etc Size User Modifiable Y N Function or Use Process to Clear PROM 64KB N No user image data stored None Additional Information All memory listed above contains code for execution...

Page 13: ...bupnp UUID library wpa_supplicant ldns Info zip TWAIN sample Data Source and Application WTL v8 0 CUPS library libjpeg v6b libxml2 Expat XML Parser Unicode Kerberos 5 sorttable Little CMS v1 15 libstd...

Page 14: ...Disclosure Paper 14 Ver 1 3 March 2011 Page 14 of 32 2 7 3 Network Protocols Figure 2 is an interface diagram depicting the protocol stacks supported by the device annotated according to the DARPA mo...

Page 15: ...and the device A shared secret is used to encrypt the traffic flowing through this tunnel SSL must be enabled in order to set up the shared secret When an IPSec tunnel is established between a client...

Page 16: ...TCP UDP SLP 443 TCP SSL 515 TCP LPR 546 UDP DHCPv6 631 TCP IPP 636 TCP sLDAP 1124 TCP UDP Network Scan Utility 1900 UDP SSDP 3003 TCP HTTP SNMP reply 5200 TCP UPnP 5353 UDP Multicast DNS 6000 UDP Set...

Page 17: ...view the properties of the device but not change them without logging into the machine with administrator privileges The HTTP server can only host the web pages resident on the device It does not and...

Page 18: ...ld be too difficult for the user SA to keep the device clock in sync with the Kerberos server so the Xerox instantiation of Kerberos has the clock skew check removed The disadvantage is that this give...

Page 19: ...SSL must also be enabled in order to use any of the Web Services Automatic Meter Reads or Network Scanning Validation Service SSL should be enabled so that the device can be securely administered fro...

Page 20: ...port and this port is active when the http server is active i e if the http server is disabled this port will be closed If someone attempted to send an SNMP reply to this port via the network the repl...

Page 21: ...nged from its default value immediately upon product installation The PIN should be set to a minimum of 8 characters in length and changed at least once per month Longer PINs can be changed less frequ...

Page 22: ...t Authentication Steps 1 The device broadcasts an authentication request that is answered by the Domain Controller 2 The Domain Controller responds back to the device whether or not the user was succe...

Page 23: ...est directly to the Domain Controller through the router using the IP address of the Domain Controller 4 The Domain Controller responds back to the device through the router whether or not the user wa...

Page 24: ...Scan to E mail The device logs into an SMTP Server as set up by the SA via CWIS It will only log into the Server when a user attempts to use the scan to email feature At the time the LDAP server must...

Page 25: ...ation Server has been established the Meter Assistant service will poll the Xerox Communication server daily over the network The server will check whether it is time in the billing cycle to update th...

Page 26: ...Ver 1 3 March 2011 Page 26 of 32 5 Responses to Known Vulnerabilities 5 1 Security Xerox www xerox com security Xerox maintains an evergreen public web page that contains the latest security informati...

Page 27: ...kard HTTP Hypertext transfer protocol IBM International Business Machines ICMP Internet Control Message Protocol IETF Internet Engineering Task Force IFAX Internet Fax IIT Image Input Terminal the sca...

Page 28: ...e Location Protocol SNMP Simple Network Management Protocol SRAM Static Random Access Memory SSDP Simple Service Discovery Protocol SSL Secure Sockets Layer TCP Transmission Control Protocol TIFF Tagg...

Page 29: ...re supported as long as the basic MIB structures have been implemented SNMP version Network Transport support WorkCentre SNMPv1 RFC 1157 supported SNMPv2P RFCs 140x supported SNMPv2C RFCs 190x support...

Page 30: ...hange GET SET TRAP PDU community names supported Printer MIB traps supported printerV1Alert printerV2Alert SNMP Generic Traps supported coldStart warmStart authenticationFailure Vendor specific Traps...

Page 31: ...trap Protocol BOOTP 1542 X 500 Distinguished Name RFC references 1779 2253 2297 2293 SLP 2608 Dynamic Host Configuration Protocol DHCP 2131 DHCP Options and BOOTP Vendor Extensions 2132 X 509 Certific...

Page 32: ...re Paper 32 Ver 1 3 March 2011 Page 32 of 32 Portable Document Format Reference Manual Version 1 3 6 4 Appendix E References Kerberos FAQ http www nrl navy mil CCS people kenh kerberos faq html IP por...

Reviews: